CVE-2026-80561

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> libceph: fix multiple unsafe decodes in decode_locker()<br /> <br /> decode_locker() in cls_lock_client.c contains three unsafe decode<br /> operations that allow a malicious or compromised OSD to trigger<br /> slab-out-of-bounds reads:<br /> <br /> 1. ceph_decode_copy() at the locker_id_t name field has no preceding<br /> bounds check. With p == end after ceph_start_decoding() accepts<br /> struct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past<br /> the validated buffer boundary.<br /> <br /> 2. *p += sizeof(struct ceph_timespec) after the locker_info_t header<br /> is an unchecked pointer advance. A malicious OSD can position p<br /> past end, causing all subsequent _safe checks to pass against a<br /> bogus boundary.<br /> <br /> 3. len = ceph_decode_32(p) has no preceding bounds check, and the<br /> immediately following *p += len is uncapped. A malicious OSD can<br /> send len=0xffffffff, advancing p gigabytes past end and escaping<br /> the decode window entirely.<br /> <br /> Fix all three by replacing bare operations with their safe variants:<br /> ceph_decode_copy -&gt; ceph_decode_copy_safe<br /> *p += sizeof(...) -&gt; ceph_decode_skip_n<br /> ceph_decode_32(p) -&gt; ceph_decode_32_safe<br /> *p += len -&gt; ceph_decode_skip_n<br /> <br /> A new label is added to return -EINVAL on any bounds violation.<br /> -EINVAL is appropriate here: the data received from the OSD<br /> is structurally malformed, which is an invalid argument to the decode<br /> contract regardless of whether the caller or the wire is at fault.<br /> <br /> Attacker model: a malicious or compromised OSD in a multi-tenant Ceph<br /> deployment can trigger this against any kernel client that issues the<br /> lock.get_info class method (e.g. during RBD exclusive lock acquisition)<br /> without any further privileges beyond OSD session establishment.<br /> <br /> [ idryomov: use ceph_decode_skip_string() to skip description, trim<br /> changelog ]